Comment by josecastillo | Hacker News Reader

Comment by josecastillo | Hacker News Reader

Parent Full thread

It might be worth making another post to highlight an additional concern: this repository itself appears to leak profile images of many Grindr users. The raw-data folder includes nearly 14,000 files, including many ads and scripts, but also thumbnails of many user profiles. This file[1] for example, once you strip out the HTTP headers, is a JPEG that shows the legs and gym socks of one user. This one [2] shows a user's bare torso.

I would link to others, but most of the ones that I've found include clear views of users' faces, sometimes clothed and sometimes shirtless. In some cases it looks like the photos were taken in their homes. It's ironic that in exposing Grindr's mishandling of users' personal data, this party appears to have mishandled personal data themselves.

[1]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas...

[2]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas...

Somebody needs to write a Peter Thiel / Not Peter Thiel script, and cross reference the photos with his Friendster profile pic where he was shirtless on a boat advertising for twinks (pro tip for people who think he was outed by Gawker, he was one of the most obvious closet cases in San Francisco).

Since SINTEF is based in Norway, it's certainly possible that my profile picture is somewhere in there, and that really pisses me off. I'm out and have no problem with people knowing that I'm gay, but I shouldn't have to deal with "researchers" pulling this type of crap.

Are you happier with teens in Slovakia pulling this type of crap? If it isn't locked down someone has already scraped it and saved it forever. That you don't see most of the data being stored about you means nothing.

Just another data-point explaining why in 10 years you got pulled off that Emirates plane in a layover in Dubai and were never seen from again.

To me that's the slippery slope argument.

Sure, someone else could have done it already, or could be doing it right now. But SINTEF is supposed to be reputable research organization, and I think it's more than acceptable to expect them to properly handle any data they gather.

Grindr faces significant hurdles in improving security and complying with GDPR, and we do need to hold them to account, but that does not absolve SINTEF of their responsibilities either.

Good job finding sensitive information in the repo but I hope you ensured that the data is deleted before making this issue public

Reply on news.ycombinator.com